A computer system is a layered device that includes a hardware layer, a firmware and operating system layer, and an applications program layer. The hardware layer of the computer system is often referred to as a physical platform. The platform may include processors, chipsets, communications channels, memory, boards and systems. Typically, a single operating system controls all hardware layer resources in the computer system.
A virtual machine is one of a number of discrete execution environments in a computer system. Each virtual machine may execute an operating system and is isolated from the other virtual machines so that each virtual machine appears to a user to “own” all the hardware resources of the computer system. Typically, a virtual machine monitor (VMM), sometimes referred to as a virtual machine manager, provides the capability to share the computer system's hardware resources among the virtual machines. In some systems, a virtual machine monitor may simulate the complete hardware or partially simulate some of the hardware. In other systems, instead of simulating hardware, the virtual machine monitor may provide access to the hardware resources through an Applications Programming Interface (API). Thus, through the use of VMM, one physical platform can function as multiple “virtual” machines.
The physical platform may include a Network Interface Controller (Card) (NIC) which is a device for transmitting and receiving packets over a communications network such as a Wide Area Network (WAN) or a Local Area Network (LAN). A system may have many different types of NICs manufactured by different vendors that support different network protocols.
Due to the increased number of computer viruses and malicious attacks on data networks, it is time consuming to keep virus definitions and rules used for filtering and firewall functions up to date as per an information technology policy. Also systems must be periodically updated to protect against tampering of firewall/filtering functions by users or malware in order to provide a secure and trusted platform in which manageability applications may execute.
Typically, a para virtualized front-end/back-end driver is created for each different type of NIC. In this scheme the back-end driver in a secure operating system controls the NIC. The front-end driver in a user operating system communicates input/output (IO) requests to the back-end drivers in the secure operating system to access the NIC. Filtering software intercepts the traffic sent from the front end driver to the back end driver to perform the filtering and inspection.
However, a back end para-virtualized device driver must be created in the secure operating system for each different type of NIC. This may not be possible for all NICs. For example, some device drivers are developed by independent hardware vendors (IHV) or operating system vendors (OSV). Thus, virtual machine monitor (VMM) vendors may not have access to the device driver specifications or source code in order to create the back end para-virtualized device driver. Hence traffic received from network end points that do not have back end para-virtualized device drivers in the secure operating system cannot be filtered and inspected by the firewall and virus scanning software in the secure operating system.
Furthermore, some operating systems such as Microsoft® Windows® XP and Microsoft® Windows® Vista have stringent operating system device driver certification requirements. This makes achieving certifications for the front-end drivers difficult especially when the front-end and back-end drivers run on dissimilar operating systems. For example, the front-end may run on the Microsoft Vista operating system and the backend may run on the Linux operating system. Thus, this requires creating and supporting an operating system device driver for each operating system supported by the system which is time consuming and expensive.
Although the following Detailed Description will proceed with reference being made to illustrative embodiments of the claimed subject matter, many alternatives, modifications, and variations thereof will be apparent to those skilled in the art. Accordingly, it is intended that the claimed subject matter be viewed broadly, and be defined only as set forth in the accompanying claims.